# Vulnerabilities published in 2024


- [CVE-2024-40614](https://insights.sbomify.com/CVE-2024-40614/): EGroupware mishandles an ORDER BY clause (medium 6.5)
- [CVE-2024-4061](https://insights.sbomify.com/CVE-2024-4061/): Survey Maker < 4.2.9 - Admin+ Stored XSS via Plugin Settings (medium 4.8)
- [CVE-2024-40605](https://insights.sbomify.com/CVE-2024-40605/): Cross-site scripting in mediawiki:mediawiki (medium 4.8)
- [CVE-2024-40604](https://insights.sbomify.com/CVE-2024-40604/): Cross-site scripting in mediawiki:mediawiki (medium 4.8)
- [CVE-2024-40603](https://insights.sbomify.com/CVE-2024-40603/): Cross-site request forgery in mediawiki:mediawiki (medium 4.3)
- [CVE-2024-40602](https://insights.sbomify.com/CVE-2024-40602/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2024-40601](https://insights.sbomify.com/CVE-2024-40601/): Cross-site request forgery in mediawiki:mediawiki (medium 6.3)
- [CVE-2024-40600](https://insights.sbomify.com/CVE-2024-40600/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2024-4060](https://insights.sbomify.com/CVE-2024-4060/): Use after free in Chrome (high 7.5)
- [CVE-2024-40599](https://insights.sbomify.com/CVE-2024-40599/): Cross-site scripting in mediawiki:mediawiki (medium 4.8)
- [CVE-2024-40598](https://insights.sbomify.com/CVE-2024-40598/): Information disclosure in mediawiki:mediawiki (medium 4.3)
- [CVE-2024-40597](https://insights.sbomify.com/CVE-2024-40597/): Information disclosure in mediawiki:mediawiki (high 7.5)
- [CVE-2024-40596](https://insights.sbomify.com/CVE-2024-40596/): Information disclosure in mediawiki:mediawiki (medium 4.3)
- [CVE-2024-40595](https://insights.sbomify.com/CVE-2024-40595/): An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions (SPS) On Premise before 7.5.1 (and LTS (medium 5.3)
- [CVE-2024-40594](https://insights.sbomify.com/CVE-2024-40594/): The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps. (low 2.3)
- [CVE-2024-40593](https://insights.sbomify.com/CVE-2024-40593/): Information disclosure in FortiAnalyzer (medium 5.9)
- [CVE-2024-40592](https://insights.sbomify.com/CVE-2024-40592/): Race condition in FortiClientMac (medium 6.8)
- [CVE-2024-40591](https://insights.sbomify.com/CVE-2024-40591/): Privilege escalation in FortiOS (high 8.0)
- [CVE-2024-40590](https://insights.sbomify.com/CVE-2024-40590/): Security feature bypass in FortiPortal (medium 4.4)
- [CVE-2024-4059](https://insights.sbomify.com/CVE-2024-4059/): Memory corruption in Chrome (medium 6.5)
- [CVE-2024-40588](https://insights.sbomify.com/CVE-2024-40588/): Path traversal in FortiCamera (medium 4.2)
- [CVE-2024-40587](https://insights.sbomify.com/CVE-2024-40587/): Command injection in FortiVoice (medium 6.3)
- [CVE-2024-40586](https://insights.sbomify.com/CVE-2024-40586/): Privilege escalation in FortiClientWindows (medium 6.3)
- [CVE-2024-40585](https://insights.sbomify.com/CVE-2024-40585/): Information disclosure in FortiAnalyzer (medium 5.9)
- [CVE-2024-40584](https://insights.sbomify.com/CVE-2024-40584/): Command injection in FortiAnalyzer (medium 6.8)
- [CVE-2024-40583](https://insights.sbomify.com/CVE-2024-40583/): Information disclosure in pentaminds:curovms (critical 9.1)
- [CVE-2024-40582](https://insights.sbomify.com/CVE-2024-40582/): Information disclosure in pentaminds:curovms (high 7.5)
- [CVE-2024-4058](https://insights.sbomify.com/CVE-2024-4058/): Memory corruption in Chrome (critical 9.0)
- [CVE-2024-40579](https://insights.sbomify.com/CVE-2024-40579/): Cross Site Scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v.1.7.1 allows a remote attacker to obtain sensitive inf (medium 6.1)
- [CVE-2024-40576](https://insights.sbomify.com/CVE-2024-40576/): Cross-site scripting in mayurik:best house rental management system (medium 4.7)
- [CVE-2024-40575](https://insights.sbomify.com/CVE-2024-40575/): Denial of service in huawei:opengauss (medium 6.5)
- [CVE-2024-40570](https://insights.sbomify.com/CVE-2024-40570/): SQL injection in seacms:seacms (medium 6.5)
- [CVE-2024-4057](https://insights.sbomify.com/CVE-2024-4057/): Gutenberg Blocks by Kadence Blocks < 3.2.37 - Contributor+ Stored XSS (medium 6.1)
- [CVE-2024-40568](https://insights.sbomify.com/CVE-2024-40568/): Buffer Overflow vulnerability in btstack mesh commit before v.864e2f2b6b7878c8fab3cf5ee84ae566e3380c58 allows a remote attacker to execute a (critical 9.8)
- [CVE-2024-40560](https://insights.sbomify.com/CVE-2024-40560/): SQL injection in project team:tmall demo (high 7.3)
- [CVE-2024-4056](https://insights.sbomify.com/CVE-2024-4056/): Denial of service condition in M-Files Server (high 7.5)
- [CVE-2024-40555](https://insights.sbomify.com/CVE-2024-40555/): File upload in project team:tmall demo (medium 5.3)
- [CVE-2024-40554](https://insights.sbomify.com/CVE-2024-40554/): Missing authorization in project team:tmall demo (high 7.5)
- [CVE-2024-40553](https://insights.sbomify.com/CVE-2024-40553/): File upload in project team:tmall demo (medium 4.9)
- [CVE-2024-40552](https://insights.sbomify.com/CVE-2024-40552/): Code injection in publiccms:publiccms (high 8.8)
- [CVE-2024-40551](https://insights.sbomify.com/CVE-2024-40551/): File upload in publiccms:publiccms (medium 6.2)
- [CVE-2024-40550](https://insights.sbomify.com/CVE-2024-40550/): File upload in publiccms:publiccms (high 8.8)
- [CVE-2024-40549](https://insights.sbomify.com/CVE-2024-40549/): File upload in publiccms:publiccms (high 8.8)
- [CVE-2024-40548](https://insights.sbomify.com/CVE-2024-40548/): File upload in publiccms:publiccms (high 8.8)
- [CVE-2024-40547](https://insights.sbomify.com/CVE-2024-40547/): Missing authorization in publiccms:publiccms (medium 6.5)
- [CVE-2024-40546](https://insights.sbomify.com/CVE-2024-40546/): File upload in publiccms:publiccms (high 8.8)
- [CVE-2024-40545](https://insights.sbomify.com/CVE-2024-40545/): File upload in publiccms:publiccms (high 7.2)
- [CVE-2024-40544](https://insights.sbomify.com/CVE-2024-40544/): Server-side request forgery in publiccms:publiccms (high 8.8)
- [CVE-2024-40543](https://insights.sbomify.com/CVE-2024-40543/): Server-side request forgery in publiccms:publiccms (medium 6.4)
- [CVE-2024-40542](https://insights.sbomify.com/CVE-2024-40542/): SQL injection in codermy:my-springsecurity-plus (medium 6.3)
- [CVE-2024-40541](https://insights.sbomify.com/CVE-2024-40541/): SQL injection in codermy:my-springsecurity-plus (medium 6.2)
- [CVE-2024-40540](https://insights.sbomify.com/CVE-2024-40540/): SQL injection in codermy:my-springsecurity-plus (medium 6.2)
- [CVE-2024-40539](https://insights.sbomify.com/CVE-2024-40539/): SQL injection in codermy:my-springsecurity-plus (medium 6.2)
- [CVE-2024-40536](https://insights.sbomify.com/CVE-2024-40536/): Memory corruption in szlbt:lbt-t300-t400 firmware (medium 5.3)
- [CVE-2024-40535](https://insights.sbomify.com/CVE-2024-40535/): Memory corruption in szlbt:lbt-t300-t400 firmware (critical 9.8)
- [CVE-2024-40531](https://insights.sbomify.com/CVE-2024-40531/): A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072. (high 8.8)
- [CVE-2024-40530](https://insights.sbomify.com/CVE-2024-40530/): A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating (high 7.5)
- [CVE-2024-40524](https://insights.sbomify.com/CVE-2024-40524/): Directory Traversal vulnerability in xmind2testcase v.1.5 allows a remote attacker to execute arbitrary code via the webtool\application.py component. (critical 9.8)
- [CVE-2024-40522](https://insights.sbomify.com/CVE-2024-40522/): Code injection in seacms:seacms (high 8.8)
- [CVE-2024-40521](https://insights.sbomify.com/CVE-2024-40521/): Code injection in seacms:seacms (high 7.2)
- [CVE-2024-40520](https://insights.sbomify.com/CVE-2024-40520/): Code injection in seacms:seacms (high 8.8)
- [CVE-2024-40519](https://insights.sbomify.com/CVE-2024-40519/): Code injection in seacms:seacms (high 8.8)
- [CVE-2024-40518](https://insights.sbomify.com/CVE-2024-40518/): Code injection in seacms:seacms (high 7.2)
- [CVE-2024-40516](https://insights.sbomify.com/CVE-2024-40516/): An issue in H3C Technologies Co., Limited H3C Magic RC3000 RC3000V100R009 allows a remote attacker to execute arbitrary code via the Routing functionality. (high 8.8)
- [CVE-2024-40515](https://insights.sbomify.com/CVE-2024-40515/): Code injection in tenda:ax2 pro firmware (critical 9.8)
- [CVE-2024-40514](https://insights.sbomify.com/CVE-2024-40514/): Privilege escalation in themesbrand:chatvia (medium 4.6)
- [CVE-2024-40513](https://insights.sbomify.com/CVE-2024-40513/): File upload in themesbrand:chatvia (medium 4.6)
- [CVE-2024-40512](https://insights.sbomify.com/CVE-2024-40512/): Cross-site scripting in openpetra:openpetra (high 7.3)
- [CVE-2024-40511](https://insights.sbomify.com/CVE-2024-40511/): Cross-site scripting in openpetra:openpetra (high 7.3)
- [CVE-2024-40510](https://insights.sbomify.com/CVE-2024-40510/): Cross-site scripting in openpetra:openpetra (high 8.2)
- [CVE-2024-40509](https://insights.sbomify.com/CVE-2024-40509/): Cross-site scripting in openpetra:openpetra (high 7.3)
- [CVE-2024-40508](https://insights.sbomify.com/CVE-2024-40508/): Cross-site scripting in openpetra:openpetra (high 7.3)
- [CVE-2024-40507](https://insights.sbomify.com/CVE-2024-40507/): Cross-site scripting in openpetra:openpetra (high 7.3)
- [CVE-2024-40506](https://insights.sbomify.com/CVE-2024-40506/): Cross-site scripting in openpetra:openpetra (high 7.3)
- [CVE-2024-40505](https://insights.sbomify.com/CVE-2024-40505/): Path traversal in dlink:dap-1650 firmware (critical 9.3)
- [CVE-2024-40503](https://insights.sbomify.com/CVE-2024-40503/): Denial of service in tenda:ax12 firmware (medium 6.5)
- [CVE-2024-40502](https://insights.sbomify.com/CVE-2024-40502/): SQL injection in angeljudesuarez:hospital management system (critical 9.8)
- [CVE-2024-40500](https://insights.sbomify.com/CVE-2024-40500/): Cross-site scripting in scilico:i\, librarian (high 8.8)
- [CVE-2024-40498](https://insights.sbomify.com/CVE-2024-40498/): SQL Injection vulnerability in PuneethReddyHC Online Shopping sysstem advanced v.1.0 allows an attacker to execute arbitrary code via the re (critical 9.8)
- [CVE-2024-40495](https://insights.sbomify.com/CVE-2024-40495/): Code injection in linksys:e2500 firmware (high 8.0)
- [CVE-2024-40494](https://insights.sbomify.com/CVE-2024-40494/): Memory corruption in keith-cullen:freecoap (critical 9.8)
- [CVE-2024-40493](https://insights.sbomify.com/CVE-2024-40493/): Null dereference in keith-cullen:freecoap (medium 5.3)
- [CVE-2024-40492](https://insights.sbomify.com/CVE-2024-40492/): Cross-site scripting in heartbeat:heartbeat (high 7.1)
- [CVE-2024-40490](https://insights.sbomify.com/CVE-2024-40490/): An issue in Sourcebans++ before v.1.8.0 allows a remote attacker to obtain sensitive information via a crafted XAJAX call to the Forgot Password function. (high 7.5)
- [CVE-2024-40489](https://insights.sbomify.com/CVE-2024-40489/): Code injection in jeecg:jeecg boot (critical 9.8)
- [CVE-2024-40488](https://insights.sbomify.com/CVE-2024-40488/): Cross-site request forgery in lopalopa:live membership system (high 8.8)
- [CVE-2024-40487](https://insights.sbomify.com/CVE-2024-40487/): Cross-site scripting in lopalopa:live membership system (high 7.6)
- [CVE-2024-40486](https://insights.sbomify.com/CVE-2024-40486/): SQL injection in lopalopa:live membership system (critical 9.8)
- [CVE-2024-40484](https://insights.sbomify.com/CVE-2024-40484/): Cross-site scripting in phpgurukul:old age home management system (medium 6.1)
- [CVE-2024-40482](https://insights.sbomify.com/CVE-2024-40482/): File upload in lopalopa:live membership system (critical 9.8)
- [CVE-2024-40481](https://insights.sbomify.com/CVE-2024-40481/): Cross-site scripting in phpgurukul:old age home management system (medium 6.1)
- [CVE-2024-40480](https://insights.sbomify.com/CVE-2024-40480/): Missing authorization in jayesh:online exam system (critical 9.8)
- [CVE-2024-40479](https://insights.sbomify.com/CVE-2024-40479/): SQL injection in jayesh:online exam system (high 8.1)
- [CVE-2024-40478](https://insights.sbomify.com/CVE-2024-40478/): Cross-site scripting in jayesh:online exam system (medium 5.4)
- [CVE-2024-40477](https://insights.sbomify.com/CVE-2024-40477/): SQL injection in phpgurukul:old age home management system (critical 9.8)
- [CVE-2024-40476](https://insights.sbomify.com/CVE-2024-40476/): Cross-site request forgery in mayurik:best house rental management (high 8.8)
- [CVE-2024-40475](https://insights.sbomify.com/CVE-2024-40475/): Missing authorization in mayurik:best house rental management system (medium 5.3)
- [CVE-2024-40474](https://insights.sbomify.com/CVE-2024-40474/): Cross-site scripting in mayurik:best house rental management system (high 8.8)
- [CVE-2024-40473](https://insights.sbomify.com/CVE-2024-40473/): Cross-site scripting in mayurik:best house rental management system (medium 5.4)
- [CVE-2024-40472](https://insights.sbomify.com/CVE-2024-40472/): SQL injection in rems:daily calories monitoring tool (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/306/